3 ms·
I sincerely hope you don't do this. You're trusting that the people who run that site won't turn malicious in the future; and since your link uses http, you are
by yrro 11y ago
I sincerely hope you don't do this. You're trusting that the people who run that site won't turn malicious in the future; and since your link uses http, you are also trusting that the same applies to their ISP, your ISP, or anyone in between!
- stephengillie 11y agoYeah, someone might hijack localhost's address. They might even be so nefarious as to submit RFCs to make that address range publicly routable.
- jasonlotito 11y agoNot the person you are responding to, but it's obvious he's referring to the suggestion that you automatically update the hosts file from the URL. > set up a refresh script to replace it periodically. Especially considering the https version of the page isn't valid.
- fidget 11y ago`x.x.x.x foobar.com` Where x.x.x.x:80 is a redirect to some malicious site. Here's hoping foobar.com set up HSTS
- tejtm 11y agoyou could run it through your own sanitizer before deploying even something as simple as egrep -v "^127.0.0.1|^#|^$" hosts.zero should help ease your mind that the worst an attacker could do is make some site you want to go to apparently unavailable, but that would be under your control to fix too.
- buckbova 11y agoWorked literally for a decade. But I suppose anything can happen.